unity-scene-create

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a series of shell commands through the unity-cli tool to manage Unity scenes, GameObjects, and components. This includes both high-level subcommands and a raw mode for low-level payload delivery via JSON-formatted arguments.- [DYNAMIC_EXECUTION]: Instructions in references/runtime-checklist.md advise the agent to use cargo run -- <args> to compile and execute the tool from source when a global binary is not available in the workspace. This involves runtime compilation of the local codebase using the Rust build system.- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect injection by accepting user-defined strings for GameObject names and component types which are interpolated into shell command arguments.
  • Ingestion points: User requests for creating or modifying scene elements as described in SKILL.md examples.
  • Boundary markers: The skill does not define specific text delimiters but relies on structured JSON formatting to separate instructions from data.
  • Capability inventory: The agent has the ability to execute shell commands and compile code via the unity-cli and cargo toolchains.
  • Sanitization: The references/runtime-checklist.md file contains a security best practice instruction to "Keep JSON payloads quoted as a single shell argument," which helps mitigate command injection risks when processing user-supplied data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:42 PM